TCP Attacks Chester Rebeiro IIT Madras Some of the slides borrowed - PowerPoint PPT Presentation

TCP Attacks Chester Rebeiro IIT Madras Some of the slides borrowed from the book ‘Computer Security: A Hands on Approach’ by Wenliang Du

A Typical TCP Client 2

A Typical TCP Server create a IPV4 stream socket Bind to port number 9090. This will tell the OS to route all client to port 9090 to this server Listen for connections on this socket. (This is a non-blocking call. It is used to inform the OS that there server is ready to accept clients. Accept connection from a client. (This is typically a blocking call) Finally, communicate with the client using read/write calls and the socket. 3

The TCP Header Ethernet IP TCP Payload header header header 4

Why TCP? Main problem wih IP • Due to unpredictable network behavior, load balancing, and network congestions, packets can be lost, duplicated, or delivered out of order TCP handles these • Acknowledging every packet received • By rearranging out-of-order data • By automatic retransmission of lost data • By TCP Congestion avoidance algorithms "TCP provides reliable, ordered, and error-checked delivery of a stream of octets (bytes) between applications running on hosts communicating via an IP network." https://en.wikipedia.org/wiki/Transmission_Control_Protocol 5

Out-of-order Reception of Frames Sequence Number (32 bit) S+ S Payload 1 Payload 3 2 TCP header time S+ time Payload 2 Payload 1 S 1 S+ S+ Payload 3 Payload 4 2 3 S+ Payload 4 3 @ SENDER @ RECEIVER 6

Stop-and-Wait ARQ @SENDER Window of packets to be sent @SENDER� S S+1 S+2 S+3 S+4 S @RECEIVER S ACK time S+1 S+1 Automatic Repeat Request ACK S+4 Actual implementation may vary from OS to OS S+2 and will depend on oter factors like (1) expected round trip time (2) Max number of retransmission attempts S+2 Not an efficient way of achieving reliable S+2 communication. S+2 https://tools.ietf.org/rfc/rfc3366.txt 7

Go-Back-N ARQ @SENDER Window of packets to be sent @SENDER� S S+1 S+2 S+3 S+4 S S+1 time @RECEIVER S+2 S+2 Automatic Repeat Request S+3 S S+4 Actual implementation may vary from OS to OS ACK S+1 and will depend on oter factors like ACK (1) expected round trip time S+4 (2) window size in OS (3) Max number of retransmission attempts S+2 S+3 S+4 8

Selective Repeat ARQ Acknowledge with the minimum sequence @SENDER number that has not been Window of packets to be sent received @SENDER� S S+1 S+2 S+3 S+4 S S+1 time @RECEIVER S+2 @RECEIVER Window of received packets S+3 (out-of-order) S+2 ACK S S+4 S S+2 S S+1 S+4 ACK S+1 S+1 ACK S+3 S+4 ACK S+3 @RECEIVER Reconstructing packets S+3 S+5 S S+1 S+2 9

Bootstrapping Communication between Server and Client Three Way Handshaking Protocol x and y are random numbers selected by client and server respectively. connect listen invoked Connection State: SYN RECEIVED (place connection details in a queue) Connection state: ESTABLISHED Full connection established 10

Queue The queue is maintained in TCP module in the OS on a per-server basis The queue is created when listen is called Specifies the size of the queue. This size indicates the maximum rate at which the server can accept new connections. https://en.wikipedia.org/wiki/Transmission_Control_Protocol 11

Queue Behavior on BSD A single queue is present. entries can move SYN RECEIVED to ESTABLISHED Entries will be dequeued when • Connection is closed • A Reset packet is obtained 12

Queue Behavior on Linux Two queues are present: Syn-Queue and Accept-Queue • When SYN received, entry queued in Syn-Queue • When ACK received, entry moved to Accept-Queue Backlog specifies the length of the Accept-Queue The length of Syn-Queue is present in /proc/sys/net/ipv4/ tcp_max_syn_backlog Entries in Syn-Queue will be present until: (1) ACK received (2) SYN+ACK retries have been completed (presen in /proc/sys/net/ipv4/tcp_synack_retries) 13

Question! What should be done when the Accept Queue is full? 14

SYN Flooding Attack Flood the Syn-Queue *1* send a lot of SYN packets to the server quickly *2* Do not respond with the ACK packet • SYN-queue will get filled up and the server will not accept any new connections 15

SYN Flooding Attack Flood the Syn-Queue *1* send a lot of SYN packets to the server quickly *2* Do not respond with the ACK packet • SYN-queue will get filled up and the server will not accept any new connections Dequeue can occur only in the following two conditions *1* A reset packet is received. (Can occur sometimes but unlikely) *2* The entry in the SYN times out (40 seconds) and will be removed. (Attacker can send many more SYN packets to always keep the buffer full) 16

Need for Spoofed Syn Packets If all SYN packets are from the same IP, then SYN Flooding attack can be easily detected and blocked by the firewall. Therefore, SYN packets need to go from spoofed random IPs All SYN+ACKs likely to reach a non-existent IP. However, if it actually reaches a valid IP, then the system will send a Reset packet, which will remove the entry from the queue. 17

Launching a Syn Flooding Attack 18

Launching a Syn Flooding Attack Normal Operation CPU utilization is not high Under Attack 19

Countermeasure #1 Don't store SYN requests. Only store Accepted connections (after the 3-handshake protocol is completed) No Queue present, so cannot be flooded! 20

Countermeasure #1 Don't store SYN requests. Only store Accepted connections (after the 3-handshake protocol is completed) No Queue present, so cannot be flooded! Will not work! SincenSYN requests are not stored, validity of ACK packets cannot be determined. Send spoofed ACK packets, to flood the Accept-Queue. 21

Countermeasure #2 SYN Cookies Owns a secret key K D. J. Bernstein (1996). Incorporated in Linux and FreeBSD kernels. * Spoofed SYN attacks can be blocked by the firewall. * If we can identify an ACK packet is valid, without storing the SYN packets, then spoofed ACK attacks will not be possible too. 22

Hash Functions 23

MAC (Message Authentication Codes) Keyed Hash Functions Secret key (K) MAC 0110101001 Constant length digest (Y) Message (x) Y = MAC_k(X) 24

Countermeasure #2 (SYN Cookies) Owns a secret key K 1. At Server: On receiving SYN Packet, with TCP header H1, compute y = MAC_k(H1) (y is sent as sequence number in SYN+ACK instead of a random number) 2. A valid ACK packet, would have y+1 in the acknowledgement field and x+1 in the sequence field. Other fields will remain the same. • From the header H2 of the ACK packet, determine H1' • Recompute y'=MAC_k(H1') • Check if y' and y for equality 25

Closing a TCP Connection Two ways to close a TCP Connection • FIN Packet (graceful closure) - typically done when server / client wants to terminate the connection. - 4 way handshake • RST Packet (abrupt closure) - used when there is no time to do the FIN protocol - Errors in the transmission - SYN attacks https://ipwithease.com/tcp-fin-vs-rst-packets/ 26

TCP Reset Attack Consider a TCP connection established between two systems 10.1.22.124:2020 110.11.122.24:8000 27

TCP Reset Attack A Single Reset Packet can break a TCP connection between two systems. 10.1.22.124:2020 110.11.122.24:8000 A spoofed RST packet can break the connection Comcast vs BitTorrent https://www.pcworld.com/article/139795/article.html The Great Firewall of China https://en.wikipedia.org/wiki/Great_Firewall 28

Building the Spoofed RST Packet Information needed to Spoof: 1. Source IP address 2. Destination IP address 3. Destination Port Address 4. Source Port Address 5. Sequence Number Difficulty of the attack can vary depending on the attacker capabilities 29

TCP Reset Attack (with man-in-the-middle or sniffer) 10.1.22.124:2020 110.11.122.24:8000 Spoofed RST Packet should have the right TCP signature 1. Source IP address (known) 2. Destination IP address (known) 3. Destination Port Address (known) Sniff and then spoof 4. Source Port Address (known) 5. Sequence Number (can be efficiently estimated) 30

TCP Reset Attack on Telnet Connection Goal: To break the Telnet connection between User and Server Setup: User (10.0.2.18) and Server (10.0.2.17) Steps : Use Wireshark on attacker machine, to sniff the traffic ● Retrieve the destination port (23), Source port number (44421) and sequence number. ●

TCP Reset Attack on Telnet Connection Using netwox tool 40, we can generate a spoofed RST packet to the client or server. If the attack is successful, the other end will see a message “Connection closed by foreign host” indicating that the connection is broken.

TCP Reset Attack on SSH connections If the encryption is done at the network layer, the entire TCP packet including the ● header is encrypted, which makes sniffing or spoofing impossible. But as SSH conducts encryption at Transport layer, the TCP header remains ● unencrypted. Hence the attack is successful as only header is required for RST packet.